From: Greg Kroah-Hartman Date: Wed, 14 Jan 2015 05:08:36 +0000 (-0800) Subject: 3.18-stable patches X-Git-Tag: v3.10.65~13 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=9b291425c599bc43bd2ddd0cc7f751ab45dac732;p=thirdparty%2Fkernel%2Fstable-queue.git 3.18-stable patches added patches: acpi-video-update-the-skip-case-for-acpi_video_device_in_dod.patch fs-nfsd-fix-signedness-bug-in-compare_blob.patch nfsd-fix-fi_delegees-leak-when-fi_had_conflict-returns-true.patch nfsd4-fix-xdr4-count-of-server-in-fs_location4.patch nfsd4-fix-xdr4-inclusion-of-escaped-char.patch --- diff --git a/queue-3.18/acpi-video-update-the-skip-case-for-acpi_video_device_in_dod.patch b/queue-3.18/acpi-video-update-the-skip-case-for-acpi_video_device_in_dod.patch new file mode 100644 index 00000000000..b008c89363a --- /dev/null +++ b/queue-3.18/acpi-video-update-the-skip-case-for-acpi_video_device_in_dod.patch @@ -0,0 +1,66 @@ +From b4df463678fb9c6dae9548dbb7545993779fd416 Mon Sep 17 00:00:00 2001 +From: Aaron Lu +Date: Mon, 15 Dec 2014 16:01:29 +0800 +Subject: ACPI / video: update the skip case for acpi_video_device_in_dod() + +From: Aaron Lu + +commit b4df463678fb9c6dae9548dbb7545993779fd416 upstream. + +If the firmware has declared more than 8 video output devices, and the +one that control the internal panel's backlight is listed after the +first 8 output devices, the _DOD will not include it due to the current +i915 operation region implementation. As a result, we will not create a +backlight device for it while we should. Solve this problem by special +case the firmware that has 8+ output devices in that if we see such a +firmware, we do not test if the device is in _DOD list. The creation of +the backlight device will also enable the firmware to emit events on +backlight hotkey press when the acpi_osi= cmdline option is specified on +those affected ASUS laptops. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=70241 +Reported-and-tested-by: Oleksij Rempel +Reported-and-tested-by: Dmitry Tunin +Reported-and-tested-by: Jimbo +Signed-off-by: Aaron Lu +Acked-by: Jani Nikula +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/video.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/drivers/acpi/video.c ++++ b/drivers/acpi/video.c +@@ -155,6 +155,7 @@ struct acpi_video_bus { + u8 dos_setting; + struct acpi_video_enumerated_device *attached_array; + u8 attached_count; ++ u8 child_count; + struct acpi_video_bus_cap cap; + struct acpi_video_bus_flags flags; + struct list_head video_device_list; +@@ -1159,8 +1160,12 @@ static bool acpi_video_device_in_dod(str + struct acpi_video_bus *video = device->video; + int i; + +- /* If we have a broken _DOD, no need to test */ +- if (!video->attached_count) ++ /* ++ * If we have a broken _DOD or we have more than 8 output devices ++ * under the graphics controller node that we can't proper deal with ++ * in the operation region code currently, no need to test. ++ */ ++ if (!video->attached_count || video->child_count > 8) + return true; + + for (i = 0; i < video->attached_count; i++) { +@@ -1413,6 +1418,7 @@ acpi_video_bus_get_devices(struct acpi_v + dev_err(&dev->dev, "Can't attach device\n"); + break; + } ++ video->child_count++; + } + return status; + } diff --git a/queue-3.18/fs-nfsd-fix-signedness-bug-in-compare_blob.patch b/queue-3.18/fs-nfsd-fix-signedness-bug-in-compare_blob.patch new file mode 100644 index 00000000000..e50c0b70ad4 --- /dev/null +++ b/queue-3.18/fs-nfsd-fix-signedness-bug-in-compare_blob.patch @@ -0,0 +1,68 @@ +From ef17af2a817db97d42dd2ec0a425231748e23dbc Mon Sep 17 00:00:00 2001 +From: Rasmus Villemoes +Date: Fri, 5 Dec 2014 16:40:07 +0100 +Subject: fs: nfsd: Fix signedness bug in compare_blob + +From: Rasmus Villemoes + +commit ef17af2a817db97d42dd2ec0a425231748e23dbc upstream. + +Bugs similar to the one in acbbe6fbb240 (kcmp: fix standard comparison +bug) are in rich supply. + +In this variant, the problem is that struct xdr_netobj::len has type +unsigned int, so the expression o1->len - o2->len _also_ has type +unsigned int; it has completely well-defined semantics, and the result +is some non-negative integer, which is always representable in a long +long. But this means that if the conditional triggers, we are +guaranteed to return a positive value from compare_blob. + +In this case it could be fixed by + +- res = o1->len - o2->len; ++ res = (long long)o1->len - (long long)o2->len; + +but I'd rather eliminate the usually broken 'return a - b;' idiom. + +Reviewed-by: Jeff Layton +Signed-off-by: Rasmus Villemoes +Signed-off-by: J. Bruce Fields +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfsd/nfs4state.c | 15 +++++++-------- + 1 file changed, 7 insertions(+), 8 deletions(-) + +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -1711,15 +1711,14 @@ static int copy_cred(struct svc_cred *ta + return 0; + } + +-static long long ++static int + compare_blob(const struct xdr_netobj *o1, const struct xdr_netobj *o2) + { +- long long res; +- +- res = o1->len - o2->len; +- if (res) +- return res; +- return (long long)memcmp(o1->data, o2->data, o1->len); ++ if (o1->len < o2->len) ++ return -1; ++ if (o1->len > o2->len) ++ return 1; ++ return memcmp(o1->data, o2->data, o1->len); + } + + static int same_name(const char *n1, const char *n2) +@@ -1907,7 +1906,7 @@ add_clp_to_name_tree(struct nfs4_client + static struct nfs4_client * + find_clp_in_name_tree(struct xdr_netobj *name, struct rb_root *root) + { +- long long cmp; ++ int cmp; + struct rb_node *node = root->rb_node; + struct nfs4_client *clp; + diff --git a/queue-3.18/nfsd-fix-fi_delegees-leak-when-fi_had_conflict-returns-true.patch b/queue-3.18/nfsd-fix-fi_delegees-leak-when-fi_had_conflict-returns-true.patch new file mode 100644 index 00000000000..728d36c8ea2 --- /dev/null +++ b/queue-3.18/nfsd-fix-fi_delegees-leak-when-fi_had_conflict-returns-true.patch @@ -0,0 +1,39 @@ +From 94ae1db226a5bcbb48372d81161f084c9e283fd8 Mon Sep 17 00:00:00 2001 +From: Jeff Layton +Date: Sat, 13 Dec 2014 09:11:39 -0500 +Subject: nfsd: fix fi_delegees leak when fi_had_conflict returns true + +From: Jeff Layton + +commit 94ae1db226a5bcbb48372d81161f084c9e283fd8 upstream. + +Currently, nfs4_set_delegation takes a reference to an existing +delegation and then checks to see if there is a conflict. If there is +one, then it doesn't release that reference. + +Change the code to take the reference after the check and only if there +is no conflict. + +Signed-off-by: Jeff Layton +Signed-off-by: J. Bruce Fields +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfsd/nfs4state.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -3890,11 +3890,11 @@ nfs4_set_delegation(struct nfs4_client * + status = nfs4_setlease(dp); + goto out; + } +- atomic_inc(&fp->fi_delegees); + if (fp->fi_had_conflict) { + status = -EAGAIN; + goto out_unlock; + } ++ atomic_inc(&fp->fi_delegees); + hash_delegation_locked(dp, fp); + status = 0; + out_unlock: diff --git a/queue-3.18/nfsd4-fix-xdr4-count-of-server-in-fs_location4.patch b/queue-3.18/nfsd4-fix-xdr4-count-of-server-in-fs_location4.patch new file mode 100644 index 00000000000..f4ff2dab5cf --- /dev/null +++ b/queue-3.18/nfsd4-fix-xdr4-count-of-server-in-fs_location4.patch @@ -0,0 +1,33 @@ +From bf7491f1be5e125eece2ec67e0f79d513caa6c7e Mon Sep 17 00:00:00 2001 +From: Benjamin Coddington +Date: Sun, 7 Dec 2014 16:05:48 -0500 +Subject: nfsd4: fix xdr4 count of server in fs_location4 + +From: Benjamin Coddington + +commit bf7491f1be5e125eece2ec67e0f79d513caa6c7e upstream. + +Fix a bug where nfsd4_encode_components_esc() incorrectly calculates the +length of server array in fs_location4--note that it is a count of the +number of array elements, not a length in bytes. + +Signed-off-by: Benjamin Coddington +Fixes: 082d4bd72a45 (nfsd4: "backfill" using write_bytes_to_xdr_buf) +Signed-off-by: J. Bruce Fields +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfsd/nfs4xdr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/nfsd/nfs4xdr.c ++++ b/fs/nfsd/nfs4xdr.c +@@ -1800,7 +1800,7 @@ static __be32 nfsd4_encode_components_es + + str = end; + } +- pathlen = htonl(xdr->buf->len - pathlen_offset); ++ pathlen = htonl(count); + write_bytes_to_xdr_buf(xdr->buf, pathlen_offset, &pathlen, 4); + return 0; + } diff --git a/queue-3.18/nfsd4-fix-xdr4-inclusion-of-escaped-char.patch b/queue-3.18/nfsd4-fix-xdr4-inclusion-of-escaped-char.patch new file mode 100644 index 00000000000..0e3ff0b331b --- /dev/null +++ b/queue-3.18/nfsd4-fix-xdr4-inclusion-of-escaped-char.patch @@ -0,0 +1,33 @@ +From 5a64e56976f1ba98743e1678c0029a98e9034c81 Mon Sep 17 00:00:00 2001 +From: Benjamin Coddington +Date: Sun, 7 Dec 2014 16:05:47 -0500 +Subject: nfsd4: fix xdr4 inclusion of escaped char + +From: Benjamin Coddington + +commit 5a64e56976f1ba98743e1678c0029a98e9034c81 upstream. + +Fix a bug where nfsd4_encode_components_esc() includes the esc_end char as +an additional string encoding. + +Signed-off-by: Benjamin Coddington +Fixes: e7a0444aef4a "nfsd: add IPv6 addr escaping to fs_location hosts" +Signed-off-by: J. Bruce Fields +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfsd/nfs4xdr.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/fs/nfsd/nfs4xdr.c ++++ b/fs/nfsd/nfs4xdr.c +@@ -1795,6 +1795,9 @@ static __be32 nfsd4_encode_components_es + } + else + end++; ++ if (found_esc) ++ end = next; ++ + str = end; + } + pathlen = htonl(xdr->buf->len - pathlen_offset); diff --git a/queue-3.18/series b/queue-3.18/series index 427a7640d00..e6768f9419c 100644 --- a/queue-3.18/series +++ b/queue-3.18/series @@ -99,3 +99,8 @@ reiserfs-destroy-allocated-commit-workqueue.patch n_tty-fix-read_buf-race-condition-increment-read_head-after-pushing-data.patch drivers-hv-vmbus-fix-a-race-condition-when-unregistering-a-device.patch drivers-hv-util-make-struct-hv_do_fcopy-match-hyper-v-host-messages.patch +fs-nfsd-fix-signedness-bug-in-compare_blob.patch +nfsd4-fix-xdr4-inclusion-of-escaped-char.patch +nfsd4-fix-xdr4-count-of-server-in-fs_location4.patch +nfsd-fix-fi_delegees-leak-when-fi_had_conflict-returns-true.patch +acpi-video-update-the-skip-case-for-acpi_video_device_in_dod.patch